The FBI attributed the February 21, 2025, theft of about $1.5 billion in virtual assets from Bybit to North Korea, using the activity name TraderTraitor. The reported attack did not break Ethereum consensus: it compromised Safe{Wallet}’s hosted interface and deceived Bybit signers about a transaction they were approving, enabling attackers to redirect the wallet’s implementation and sweep its assets.
How did North Korea pull off the Bybit hack?
The attack exploited the gap between the transaction signers thought they were approving and what the transaction would actually do. Bybit’s February 26, 2025, preliminary forensic statement said a Safe developer’s credentials were compromised, giving an attacker unauthorized access to Safe{Wallet} infrastructure. Bybit said its external reviewers found no indication that Bybit’s own infrastructure had been compromised. Those were the exchange’s preliminary findings, not a judicial determination.
A technical reconstruction in a paper hosted by Japan’s Financial Services Agency describes malicious JavaScript modified in Safe’s hosted front-end. When the targeted signers used the interface, the script altered transaction details, including the destination and data, while displaying misleading information. The paper says the manipulation applied under particular conditions and did not affect ordinary users.
From deceptive display to asset sweep
- The attacker compromised credentials associated with Safe’s developer infrastructure, according to Bybit’s preliminary account.
- The attacker altered JavaScript files in Safe’s hosted interface, according to the FSA-hosted technical analysis.
- Bybit signers used the interface to approve what appeared to be a legitimate transaction. The displayed information did not accurately convey what the transaction would execute.
- The signers’ transactions ran through an attacker-prepared Trojan contract. The technical paper says the transaction redirected the cold wallet’s implementation to a pre-deployed backdoor contract.
- The backdoor’s sweep functions transferred ETH, stETH, and other assets out of the wallet. The paper reports that the attacker restored the JavaScript to its original version and erased traces within two minutes of the theft, delaying detection.
Bybit described the attack as one in which the attacker “totally deceive[d] signers into approving a malicious transaction.” The central weakness in this incident was the integrity of the signing workflow and the information presented to signers—not evidence of a general flaw in Ethereum consensus or proof that Safe’s smart-contract codebase contained a general vulnerability.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How could a cold wallet be drained?
“Cold” describes how private keys are stored or kept offline; it does not guarantee that every part of the process for authorizing a transaction is secure. Bybit’s assets were held in a cold wallet, but signers still had to approve transactions using a software interface. In the reported attack, the interface they relied on was manipulated, so valid signer approvals authorized an operation whose effects differed from what the signers were shown.
| Layer | Role in this incident |
|---|---|
| Custody | Bybit’s assets were held in a cold wallet. |
| Control | Signers’ approvals authorized transactions, but the transaction content presented through the compromised interface was misleading. |
| Execution | Attacker-prepared contracts redirected the wallet implementation and enabled the asset sweep, according to the FSA-hosted analysis. |
This distinction matters: the fact that keys are offline does not by itself establish that the software used to construct, display, or approve a transaction is trustworthy. The public accounts describe an interface and signing-workflow compromise; they do not establish that the cold wallet was accessed by extracting its private keys.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How much crypto was stolen?
The FBI’s February 26, 2025, advisory described the theft as approximately $1.5 billion in virtual assets. Bybit’s incident timeline valued the loss at about $1.46 billion and listed these asset quantities and approximate values:
| Asset | Quantity Bybit reported | Approximate value in Bybit’s 2025 timeline |
|---|---|---|
| ETH | 401,347 | $1.12 billion |
| stETH | 90,375 | $253.16 million |
| cmETH | 15,000 | $44.13 million |
| mETH | 8,000 | $23 million |
The rounded $1.5 billion FBI figure and Bybit’s approximate $1.46 billion timeline valuation are different reported estimates of the same incident, not separate thefts.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What happened to the stolen assets?
The FBI said TraderTraitor actors rapidly converted some stolen assets into Bitcoin and other virtual assets, then dispersed funds across thousands of addresses on multiple blockchains. It warned that laundering could continue and that the assets might eventually be converted to fiat currency. Its advisory urged exchanges, bridges, RPC node operators, analytics firms, DeFi services, and other virtual-asset service providers to block transactions involving listed addresses or funds derived from them.
Bybit’s incident timeline described an initial split across 39 addresses. That is an earlier snapshot, while the FBI’s warning describes a broader, evolving trail across thousands of addresses. The figures refer to different stages of the tracing effort and should not be treated as conflicting counts of the same moment.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How much has been recovered or frozen?
Bybit’s August 7, 2026, announcement reported approximately $48.4 million recovered and approximately $30.5 million frozen across more than 28 exchanges and custodians. The company said the frozen assets remained subject to further legal and investigative action. These are dated company-reported figures, not a final accounting of the stolen assets.
Bybit also said it replenished its ETH shortfall within 72 hours of the incident. Replenishing the exchange’s reserves is not the same as recovering the stolen crypto: it describes replacing the shortfall in Bybit’s balance, not returning the stolen assets from the attackers.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Who did the FBI identify, and what is the legal status?
On February 26, 2025, the FBI attributed the theft to North Korea and designated the activity TraderTraitor. That is an attribution to a state-linked activity; the cited public record does not establish the identities of individual operators.
Bybit said on August 7, 2026, that it had sued North Korea, its Reconnaissance General Bureau, Lazarus Group, and unidentified John Doe defendants in the U.S. District Court for the District of Columbia. The company reported obtaining a preliminary injunction to preserve identified assets and quoted the court as finding that “Bybit has demonstrated a likelihood of success on the merits.” A preliminary injunction is part of an ongoing civil case, not a final judgment resolving liability or the ultimate recovery of assets.
Quick Recap
What remains uncertain?
- The cited public sources do not identify individual operators or establish the full chain of command behind the attack.
- They do not provide a complete final accounting of every stolen asset or establish that all funds have been traced, frozen, or recovered.
- The recovery and frozen-asset amounts Bybit reported on August 7, 2026, are snapshots from that date; the legal and investigative process was continuing.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
